[toweringgoat]

So much this. So many people conflate citizenship and residency, and it leads to no end of confusion. GDPR applies to EU residents, accessing services from the EU, and some more edge cases. But not to EU citizens.

(There are countries with up to 30% non-citizens, and there are plenty of multi citizens. The distinction is entirely relevant.)

[zerostar07]

Not even residents (meaning permanent residents). People who are in the Union's territories (including tourists / visitors). Like most laws it applies wherever EU countries have jurisdiction. It applies to all your users if your business is located in the EU though.